Mutual TLS with ServiceCallout and TargetServer

[roberthoppe]

Hi Guys,

I have to ask since it feels weird for me. On Target Servers there is the Option "Enable Two-way TLS (Client Authorization). So from my point of view this should be enough to setup a Mutual TLS connection to the destination.

But the following code within my TargetEndpoint isn't working:

    <HTTPTargetConnection>
        <Properties>
            <Property name="request.retain.headers">Host</Property>
            <Property name="request.retain.headers.enabled">true</Property>
        </Properties>
        <LoadBalancer>
            <Server name="my_server_v1"/>
        </LoadBalancer>
        <Path>/some_path</Path>
    </HTTPTargetConnection>

But when I provide the SSL info its working:

    <HTTPTargetConnection>
        <Properties>
            <Property name="request.retain.headers">Host</Property>
            <Property name="request.retain.headers.enabled">true</Property>
        </Properties>
        <SSLInfo>
            <Enabled>true</Enabled>
            <ClientAuthEnabled>true</ClientAuthEnabled>
            <KeyStore>ref://on-prem.myrz</KeyStore>
            <KeyAlias>myapi-apigee-edge.myrz</KeyAlias>
        </SSLInfo>
        <LoadBalancer>
            <Server name="my_server_v1"/>
        </LoadBalancer>
        <Path>/some_path</Path>
    </HTTPTargetConnection>

Shouldn't that be handled transparently since I've enabled Mutual TLS already on the TargetServer "my_server_v1 Level? Feels for me duplicated and therefore I think I did something wrong.

Help appreciated guys ... goal is that I just set with my scripts the Mutual TLS on the TargetServer level which helps me to parametrise some shared flows and therefore I can reuse them.